Re: [PATCH v2] nbd_genl_status: null check for nla_nest_start
From: Michal Kubecek <hidden>
Date: 2019-09-10 11:35:24
Also in:
lkml
(Just stumbled upon this patch when link to it came with a CVE bug report.) On Mon, Jul 29, 2019 at 11:42:26AM -0500, Navid Emamdoost wrote:
quoted hunk ↗ jump to hunk
nla_nest_start may fail and return NULL. The check is inserted, and errno is selected based on other call sites within the same source code. Update: removed extra new line. Signed-off-by: Navid Emamdoost <redacted> Reviewed-by: Bob Liu <redacted> --- drivers/block/nbd.c | 5 +++++ 1 file changed, 5 insertions(+)diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index 9bcde2325893..2410812d1e82 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c@@ -2149,6 +2149,11 @@ static int nbd_genl_status(struct sk_buff *skb, struct genl_info *info) } dev_list = nla_nest_start_noflag(reply, NBD_ATTR_DEVICE_LIST); + if (!dev_list) { + ret = -EMSGSIZE; + goto out; + } + if (index == -1) { ret = idr_for_each(&nbd_index_idr, &status_cb, reply); if (ret) {
You should also call nlmsg_free(reply) when you bail out so that you don't introduce a memory leak. Michal Kubecek